From a3eb1cbee93c4c10505f629b8bc8bc00e37adb8a Mon Sep 17 00:00:00 2001
From: Jez Ng
Date: Sat, 10 Nov 2012 04:46:32 -0500
Subject: Inject bookmarklets by appending them as scripts.

This *should* fix the permission problems that `eval` faced.

Closes #575, #710.
---
 content_scripts/vomnibar.coffee | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'content_scripts')

diff --git a/content_scripts/vomnibar.coffee b/content_scripts/vomnibar.coffee
index 6f4527fd..fdd698dc 100644
--- a/content_scripts/vomnibar.coffee
+++ b/content_scripts/vomnibar.coffee
@@ -213,7 +213,9 @@ extend BackgroundCompleter,
     navigateToUrl: (url, openInNewTab) ->
       # If the URL is a bookmarklet prefixed with javascript:, we shouldn't open that in a new tab.
       if url.startsWith "javascript:"
-        eval decodeURIComponent(url["javascript:".length..])
+        script = document.createElement 'script'
+        script.textContent = decodeURIComponent(url["javascript:".length..])
+        (document.head || document.documentElement).appendChild script
       else
         chrome.extension.sendRequest(
           handler: if openInNewTab then "openUrlInNewTab" else "openUrlInCurrentTab"
-- 
cgit v1.2.3